#!/bin/bash
# set -e # 建议在调试完成后开启

# color
source /etc/init.d/functions
red='\033[0;31m'
green='\033[0;32m'
yellow='\033[0;33m'
plain='\033[0m'

function ulimitConf(){
  #echo "--> Configuring user resource limits in /etc/security/limits.conf"
  # 使用标记来避免重复写入
  if ! grep -q "# CUSTOM K8S LIMITS" /etc/security/limits.conf; then
    cat >> /etc/security/limits.conf <<\EOF

# CUSTOM K8S LIMITS - Added by init script
*          soft    nproc     1048576
*          hard    nproc     1048576
root       soft    nproc     unlimited
*          soft    nofile    1048576
*          hard    nofile    1048576
*          soft    memlock   unlimited
*          hard    memlock   unlimited
EOF
  else
    echo "Limits already configured. Skipping."
  fi
}

function kernelConf(){
  #echo "--> Configuring kernel parameters in /etc/sysctl.d/k8s.conf"
  # 修正了重复的行
  cat > /etc/sysctl.d/k8s.conf <<EOF
# System configs for Kubernetes
# Generated by init script

# Generic Kernel
kernel.softlockup_panic = 1
kernel.softlockup_all_cpu_backtrace = 1

# Virtual Memory
vm.swappiness = 0
vm.overcommit_memory = 1
vm.panic_on_oom = 0
vm.max_map_count = 262144

# Filesystem
fs.inotify.max_user_watches = 1048576
fs.may_detach_mounts = 1
fs.file-max = 1048576
fs.nr_open = 1048576

# --- Networking ---
# IPv4
net.ipv4.ip_forward = 1
net.ipv4.tcp_keepalive_time = 7200
net.ipv4.tcp_keepalive_intvl = 75
net.ipv4.tcp_keepalive_probes = 9
net.ipv4.tcp_max_tw_buckets = 5000
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_max_syn_backlog = 8096
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_abort_on_overflow = 1

# IPv4 ARP
net.ipv4.neigh.default.gc_stale_time = 120
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.all.arp_announce = 2

# IPv6
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

# Bridge
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-arptables = 1

# Netfilter Conntrack
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_buckets = 262144

# Core networking
net.core.netdev_max_backlog = 1000
net.core.somaxconn = 32768
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_wmem = 4096 87380 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216

# Reserved Ports
net.ip_local_reserved_ports = 30000-32767
EOF
  # 使内核参数立即生效
  #sudo sysctl --system
}

function modulesConf_Anolis8(){
  #echo "--> Configuring kernel modules to load at boot in /etc/modules-load.d/k8s.conf"
  # 这是 Anolis/RHEL 8 的标准方法，更简洁、正确
  cat > /etc/modules-load.d/k8s.conf <<EOF
# Modules for Kubernetes networking and storage
# Load IPVS modules
ip_vs
ip_vs_rr
ip_vs_wrr
ip_vs_sh

# Required for container networking
br_netfilter
overlay

# Often required, explicit loading is safe
nf_conntrack

# Common optional modules
ipip
tun
rbd
EOF
  # 尝试立即加载这些模块
  #echo "--> Attempting to load configured modules now..."
  while read -r module; do
    # 忽略注释和空行
    [[ "$module" =~ ^\s*# ]] || [ -z "$module" ] && continue
    if ! lsmod | grep -q "^${module}"; then
      modprobe "$module" && echo "Loaded module: $module" > /dev/null
    fi
  done < /etc/modules-load.d/k8s.conf
}

function deal(){
  ulimitConf
  kernelConf
  modulesConf_Anolis8 # 调用修正后的函数
}

function main(){
  # 使用 action 函数来包裹整个处理过程
  action "$0" deal
}

main "$@"